system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-06-29 06:34:30 +00:00
Code Issues Projects Releases Wiki Activity

man: don't suggest using pam_unix.so's use_authtok switch

Browse Source 
Our dumbed down example PAM stacks do not contain cracklib/pwq modules,
hence using use_authtok on the pam_unix.so password change stack won't
work, because it has the effect that pam_unix.so never asks for a
password on its own, expecting the cracklib/pwq modules to have
queried/validated them beforehand.

I noticed this issue because of #30969: Debian's PAM setup suffers by
the same issue – even though they don't actually use our suggested PAM
fragments at all.

See: #30969
This commit is contained in:
Lennart Poettering 2024-01-17 23:41:14 +01:00 committed by Luca Boccassi
parent b9e2d83b75
commit 75f8b0fe70
3 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
factory/etc/pam.d/system-auth
View File

@ -13,7 +13,7 @@ account sufficient pam_unix.so
account required pam_permit.so
-password sufficient pam_systemd_home.so
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
password sufficient pam_unix.so sha512 shadow try_first_pass
password required pam_deny.so
-session optional pam_keyinit.so revoke

3
man/pam_systemd.xml
View File

@ -411,8 +411,7 @@ account sufficient pam_unix.so
account required pam_permit.so
-password sufficient pam_systemd_home.so
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
password sufficient pam_unix.so sha512 shadow try_first_pass
password required pam_deny.so
-session optional pam_keyinit.so revoke

2
man/pam_systemd_home.xml
View File

@ -158,7 +158,7 @@ account sufficient pam_unix.so
account required pam_permit.so
<command>-password sufficient pam_systemd_home.so</command>
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
password sufficient pam_unix.so sha512 shadow try_first_pass
password required pam_deny.so
-session optional pam_keyinit.so revoke